Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

  • max time kernel
    133s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 18:57

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>CvIFRk8YlLjDo8MPHPf/BaMt93nSpFTF3kL57kvW6ms/EfsvRwC8W2fm+iq6Mq4prkg4f7I/tFbehseLVWagfor23AqZbRdsflkN41BLkv5vmUTiqcKAkPuGRYLrR9X/wCioAazt2/Y+B7rPLF8ebbOv2q6WVAVmWQOmqAJeZo2oArIlnBU3VnlfcW1pN9jqeSb8e7ZULhz0K5vb9sZ06DWAPZXMP4w5AxogUYtI+pe/z70s4CRPyPcAGP07+zmOh/HfX6CSUXI7n9HvFfXlHVrrfCOpg4RPsrPWplxY6odJjXG2uDcNkTgl7abD+VyafbBl+x6wJ9dftgBpmh+RfQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1021) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    303acaec1c34a2e9cc0a1c4bc9db8e35

    SHA1

    8d35e71b081d0d6b9507dcb1a3c51aea8f84f606

    SHA256

    659cc423448758ab81d63639a05c420385c6eb52ad480938bba3b34359a8c091

    SHA512

    3d2c25344d1ff767cc75c5e3ae0f87a689b757b2a45a5ef0efa6dbd8dd866b4df3e350e902bf7a00fcbe17386a88096034c466d97e234fc85d90cddcf88cb886

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    a1346adaa44af654ee02e35f0aafe087

    SHA1

    f83e815176f8f04d74f6fc1ac788b03659b563aa

    SHA256

    5fd221a8222ba5602621c9e2b62258137ac4b57ddca027469533ea2e9f5827a9

    SHA512

    34fb693e77b754d59af02d1b86e8bb69f8bf55e3ecbde3b2fe6ff1fb416bcc3d86eda98bf2c9aa3e2f58adf20db6670fe9d1232b922a96902d25c844a67cbc90

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    d22b18a32e179e2e91119c6f9b63a65f

    SHA1

    dfbd3f8ee640a148f83aedd1fb0df8ef5f7a5527

    SHA256

    d526e368f31854265734fc0238f986575fcdb52d9161cb2b79a443c03bde9e3a

    SHA512

    b8785c8f27e8890c9e46efdbb1397a62cbef3ec2be4e7e86cd8177ca0c62f17659df42c44b904d3c9ee826aa13f486dcf1411f81c5f894da15d0db6e3dfb873c

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    67198abe52ae12a65300a03c342bce8a

    SHA1

    00922e43c3b59077f813799990f13c403feb9064

    SHA256

    1b679690c74b11da99913048816595a1310b49668136358334fc33a38c8ae13a

    SHA512

    902db58250d75a8940f4e99d15e4e968d867780833849f0b9f25ce345d97cd6b9bce49f83f0de47f8ff5db8a8abe6c5cf8672ca1796f571ae1f1de143be876b1

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    e70d52290c300fe341d043d3563675ca

    SHA1

    cf7154e35a7cb3619f01b49c3430dbfa1aece9bc

    SHA256

    daa423ad7229e64197ab0e917712f61a067629912fa9a421ef41a269aa141e0d

    SHA512

    efe57ca7e9ee78db47c3a51db8e4bc91852546cd206e00a96c941a605ed94465cc16d7b545854367ef7618e33e03ba6bfb561c06c680bfba829d0e972c83846d

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    54d0581695dfcf74af0f7326eca09216

    SHA1

    9c05896ab4f803354aa36aa9e05a2b9b78af3216

    SHA256

    11274d3433010408811c695d44491f443a75f914acd9aa2d39a494eecb158119

    SHA512

    0afc39cf710815d6a383e8005d195935ff4e1bd991a8ade70afc91ca5e71b79ea00a5c4129c5b398301c62254570ed5cdc2f4445ce18d0c1455fe5eda0f30c59

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    7ee06e734c41ab4a7b0bdab90ed86e28

    SHA1

    01daa19a4f2a1057e67835f5d942ccc7f8e79c48

    SHA256

    592bec247a0dcdbc49fe1f0aaba1e95e0de7892c1faa8eda57a4cadfcd783cbf

    SHA512

    0dfb9399d8dbfbe76b5f151c3123ad020465d1169697a639e48f10423e6cb911b3f1a4791a331e472189069b56b612fc86fc2bb5cd990e58ae86b1da9903e133

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    7bca2001a97696c41491108065b3c50d

    SHA1

    745405d2973d9a161f6e5514b7e15d883d427c1a

    SHA256

    70cc8ff632f5c9c6d37caec28674fad281b67ada779c41d17c0dac4b8d0a26fd

    SHA512

    82b37f233a4b9e14b736de456356221e1a09aad8b7c1bfcd145e86b917cc10ad0b157dc3c092ce9095e274c3649c4abdd896efe2c591a95f7906cb424ffe3e7d

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    57ab617073639f85559a1c682b013921

    SHA1

    5463d928e0f01548659d13150035b10596ec8573

    SHA256

    ac30e217e87f4d1fdabb8febebec4d88f5c883fae83dae47aa26d657d94d935a

    SHA512

    8be69d12f07ddf93ec18e8687b57cd2b869950333efe2331b1f2e6b2f0627618230639c241c675b7b90e8b9e3d0a23d814215ce46dd34e05d6a81109e675a0f5

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    0ce21699a1753acc7e29eaeb5f581f4c

    SHA1

    12d13e2cb54fa343958d425d966214ab528eb8b3

    SHA256

    a91f49f3db35e9de21ffa84954a04b0250abf8028b4b6e4b440f87c31d5e9862

    SHA512

    670c60bd184590447abf6250c9533d420373dcf5cef00839c44a8d2cf50081ebdb9c920f72296eeaf275a5ebc9c1f25c30466e42209a91e692afe3c15762d851

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    550f205efdf403128e7f15dbe4a662a3

    SHA1

    d74f9d189bd02114cf746545849404f90c7a8a82

    SHA256

    81dbcf2f6144abb14430bd984ba51a3e152c1405afcd3f4022f27631f2706d42

    SHA512

    e68f42b0dca34341589448e57f47c3e55fe593e74f10ae8cb449ffd09c8944abc4d646d7beabdbde61461f1b1b8abff3f92b8d6896dff14200db327478a2e3f6

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    8935af13b0fd286e7b9a7dfe4a2267b5

    SHA1

    271f00eb3f2f7985d03537cc893686427c6a6ff3

    SHA256

    255ffb6350dce42c988328cc6cf49b899eda319067d4f61933fef7b4ca83af70

    SHA512

    64ca0fc3879549f68d100a6e5880f3104a370b74bd733f63de182bc1642bf8cf6b63425e46ebbf4c2a207277a4b72f19cc9682b1ebdb87d64b2bb2ae9277c5b7

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    6bb9955c7545bc0b7ae8d7507f5ee40a

    SHA1

    c7723a5f1e7b5d223e0a441978ad2aee33585da5

    SHA256

    643b259dff0f560546deef6475bd855991e191d6fedd6d087409a4e5bb8b1944

    SHA512

    b8be1df78562405557ca05d4d94b6228ff027bcedbc3ebd8ae8cef938189558fda796c7d388642a3de76fee4bb6401c11db15259f3d250aa9928ed1c53914362

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    1ce68fbfdb443ee8f090c7831cbf53d2

    SHA1

    3b88ae4dc859d8c0bc3296acf11f21c761fa7d42

    SHA256

    b4323d799834e49c696bac5507387d61952e0994782fe3a3cd1db287ff91abe6

    SHA512

    0d2518ed0e3f870f716177db7bc579c7ef6ba6f818ed94d612cdcc04beb1df8a22989b41fe81a5fd0766d8567400bfbd8924c5f0f5626d603aa20eca28b86688

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    f60acd433a4a3742f0a73cd45be1a2a7

    SHA1

    27f2d7bd9bc92875b2ad4d0c62c58daeb3e8bcef

    SHA256

    cf06174b2bd1acc620aa9a44fd7eb7c219b3e0f3aab3fcbbc0b60a6d96afbd80

    SHA512

    649e03bf073be6c505eabee544efff751a2c2f05b526cb7ef2c797839c57a89084bef324728d6550b117868f46779d8285c4391462ffb875018b02a35437ead5

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    f41f909669930faed6a91e2e33561c0c

    SHA1

    fd80710aee81682b7ff30ee787686b48724c4a86

    SHA256

    2a1fa52e19375cdd5cfe8bcfc873b282f88d88f678ff06f7930caee42ada15e8

    SHA512

    96a30b9cc4f50052d9807324871e6681bc65f66b8c83f2764ace6927baaafd29f321a255489335cc0156d472b6ec62c1a5394a17ed389ce13c3478b0226f506f

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    4a98ba1aeecb2299c73425d02aeb1f03

    SHA1

    9457779916c02bd45f0aeaaecf8fad88c4dcbbc2

    SHA256

    50b4db1abf0df28880f7d5a78aafe41ffb5f007b1aa1c227a2f47bde60ac5630

    SHA512

    3a8f558ed786cd03c66073b26508f9bbec27fbcbc5e3d20d3e224e33e427345ba5254fda7e62b2dce56ac6872083897c924b0195586e41e636fb7eff80f98c3e

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    ed68fd1915a11e892df8cfbb35d8a0f1

    SHA1

    69df9577e88c17377f5f5d24a5b2425e4a20b5a1

    SHA256

    b77a050fece72aedabfe5f080313f29a1ee74e2206e6505f75794b5845136480

    SHA512

    0d0467d4231c59d39ccfc01d1e4b4fcfe9867ad58897b3dd3b7515fd71614384b116e770d5e3c39825e19e93a57d3325c931369cd9bf1c1a92c202c62ddf88c4

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    58f0d95b1712ccfbeb59550f083babb9

    SHA1

    9fe87b0ed257af706cb7b1557f8537f6f12873c8

    SHA256

    c6a5cf02420c18b2eb5bc6a6d4da8c705214c38745efe09a775f2aff1a3b348d

    SHA512

    a1b19c842c6cea7732a8fce2babc0cda0f27e2aa1be90c5ddfde64133b39225993c302a876e14b9d1b8447c41ee43311420684d72856e3556805c9e8844ce75b

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    29728a5364ed732f99ddf9d20bb665d7

    SHA1

    0725d8daaf9750aca21da6ef88faf1c5c0db0dae

    SHA256

    c0cbd18f17d64ad60009caca3f7fb2fdb858c634a04aa7ffad85b38e1b44bfe9

    SHA512

    03d97f5ff9202ad96a13d30623c93877a5783782d321182cfeececdc549fb89b8758226bf367abcd844ca834ff5f33e1511349855bf1a427f833a4054133b671

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    6dc02462f942dcfe011901b132cd70ff

    SHA1

    be5ab8aa257dcb60d842c2f674725be5b6f20a25

    SHA256

    16435c86e63fb2c34236e83559f08d4a3efa93a64aad4bf2f0668290534ce32d

    SHA512

    4ddb76c935015dc0acb8206a474854b2fe19f71d46873b86a0794f6815af3437f73864867a53e653f8efd2b8876bf04356a345898b734ae99be8421f7cece9fd

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    a6751ddb1ad5a42e4c0b4e6eb2611830

    SHA1

    d6b7a3bf47c529b258de66e9b48f5545e0530b9a

    SHA256

    a3354c2327dac43c72bd7f3a28fbdc7172b6c08f61551a46ddcee6a9195daf81

    SHA512

    333499c9cae5007ad51f9a014f2df15619ae779b2767348846ccfd64adf9bf6ab41a7971308cb058864c785450182cf2301d406f05b8e2e278f1677f9a385e67

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    28d0c7d4bd605f2035c848eb89836561

    SHA1

    adf1eaa0edd53dd8573259f7cb444a75a67c21aa

    SHA256

    ddb61df3dd74b5ab7189532777446916429c149e98b854a59c6d9a4a992c998d

    SHA512

    9ebc9fadbf698bf5a281b21b76e4f795af1a2d870beecfa10a2d87b0b6a9ba2f07ab3a1ae2194403e17cc4b496ced5d04f289fd1d509386bee1819ecd818464a

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    275a4e0896bf2a09d552182c530ae1b0

    SHA1

    fed3b5f9a3d72f2d14b1744f9715026417ad447e

    SHA256

    531034637d3aa323ef9748737781b2d7a859ca00f9c14e323368fee9a9022269

    SHA512

    e1ab96ab504c4f8aee01a25788c3a8ab2b06de5cb616f64bb2843e34fa9429a666b61c678eca3b2f4bcc9e541f8e2bae75e3362d54f9199b4969f8a0fdd393e8

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    0ef5462510e99f0bad2ce962d6a04410

    SHA1

    186810d6b0441e53b6d65f81e59286aba912b2c8

    SHA256

    e9ef9c71120d9f1a4b26693fb9e89e02b75e217b9bec0947338baf5d620a16ec

    SHA512

    8f07718077f96e6939b2266b774adce4db1192a3b99c1b331e2c18c0804117ad2f5d784bfff2db4ce4a76baf0dd588bcd9d5fe6f46349481323db9510bdb272d

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    e1fb8a0c85f74982798f0b616d8b7a42

    SHA1

    b58cb19aa00b7e2e9afc71c23de2f2a2cc8aa38b

    SHA256

    d3001957ccc7bb3343b01bc1bfb0fec6b01d6b6cffada3b6dc653480ec48d017

    SHA512

    ca8ff68776d3e9c647b56950f5053bb7d3ea35882507894cabd8a4abac70c569bc5c0d3605e3aba667ada683b3a96b29a44a2233fb8999cff028636c2a145337

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    c78dbd2e027d8e9796d588d5e35e3c8b

    SHA1

    77590895923e447575d33aa8c1865c3ee327425e

    SHA256

    613a89cb1f4e357324732f3cef08be71cbfca0eacc968cafcf9e086f60685789

    SHA512

    a6929ce01ff0c942f9d3228b89f0ad0f623d40501e4c91dcc333a34fa57741922e4b621ade7ac841a589486774cd5594a24cc583d6444f93e84ff95eff2cdbc4

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    97e61fe6d0ef87cd2a8a83fb3e02d709

    SHA1

    bd512e6f645d208302cc82633933b37f5466fe2c

    SHA256

    017955156e9dce006addf6d78449e72738de431db926babb73ea2140a5747c17

    SHA512

    a82e1c790e68ab541c13ed4ea88dd67b95fe6c5f86ddcd6804cdfda84ab8786a0f83876b859e892cb3c3bbe2d11031055a9eba60ae3975988e6437bab65a94dd

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    b103f356fe1f477f73fba617441198e4

    SHA1

    a7cf353ac05bf82eeea6db3081f8d909f89f0a3a

    SHA256

    101c0b2caa3217b649a74c252078282483c74a904a3cc2252abda2c9bc527880

    SHA512

    8ddf6ad2a1dfdc2ff85a991f035c2473d3b7def02c505231926e200eb3bd2779456f285abe073821c30cf656763d42a7a09b68b79b443059d2bfaf5ab206cd6c

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    a5db2b724c08cb0693429b8d58bb8ff6

    SHA1

    289e444cdf01afe249d15a031f8fb0afde9da246

    SHA256

    09e002090ff17c8655e055a0663d07270a2618aee23732c9e121458b4986f233

    SHA512

    f3fad07870dec064665160024b5e9bd7e41fea69ebfcff3a2357a61fa3ff4c5d25d1ab98c0d78babb9ca26528b35e58c72acd392269d1810f01ec85e30aa39a6

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    19fad7cca9fc7b0168a3823e3fe237bf

    SHA1

    6ab47c845f331818c13b5003d5f338c4aaee0307

    SHA256

    15d598c1128ad1c577cee14bf7a5fe8e11b51d4944112697e526b46a5d16074c

    SHA512

    d83ddbe6a7b51cb1f2080b80e74bcdcedd8a201bc60dce9577e431b47140ca936d5479b89595985759e8c256b0c0a150648dd81d9bac5f56f0e00c5819057e71

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    59cd4a45a6f39b4e421a327ccfd17425

    SHA1

    833fc6d7164129f567f099535b8d3e1b619aff78

    SHA256

    bfda8535b5818fc70f0b936541b241e20af8c5cecaa612d4a17abf52727748df

    SHA512

    2e9649257fb1c7595dde42b1550713903ca44d183eaad4a8fdf7f0427c0af546266a34e164fe0675c247725743ddd4584e5d88ab0eeded7cdd457fff08fbee2d

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    5b93d3dd22881ee0afce42298f95567d

    SHA1

    114fc013145741ec1b493b46d5ea34c1894564eb

    SHA256

    fe2b1bf8e645c3bb21286e69be5addb3f0750875eb743988bd4ece49c4a3187d

    SHA512

    a0fe781ecf355631b402f6422e0d36ad014112f4171549a2c92b68e9c353890c244a127b7970e7f6556a3bc63a43419f83dd8e3cd7f1137887c7522362f37def

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    2ef65a741dbf1939005307014488c5e7

    SHA1

    4856f662d1054fd1dc3201f1710eb02f622b2662

    SHA256

    1dac221bf3e4584e15f55905ded709368d09588683f590da53c5c423bc9395bb

    SHA512

    b0125e2a012f7aeaa783f9a34340290ca7816c31cb27de81b7488cb8b9929139636174c822b4e50b8027ced17bbe3f1e7fd028f2485ff91edbb869c8f7b9e1ef

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    82ea904e38ede895a2b9b1be95628fd8

    SHA1

    aee8273670ba525c8aa585a4e36ad083dffb565f

    SHA256

    4bc33fd34152a5d4b725c0082bce678fc3fc4bf048eb0b02981941e7b756c178

    SHA512

    633f62f2556f05efe2d50c53a6c302ef397e49aa92ee11414b51c7f55e27da16f395c3a7c80395afa0e8439624eb7e5f72ca0d2102d98156e9d7fe97331f0e78

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    ace2f1c43881e1e74a744a1737d7ce0b

    SHA1

    5b582577a2c849446c01de753d0d661cb2fd1d44

    SHA256

    7e3721422665090ea1dc76552cc07d89bad74ef2b3a26060e9718109896ce5e9

    SHA512

    49ccb4791db16b4190631cccb2b9e5c4c86b8b3ce006244e2003ae913bf8421d3c7623c891df4cce34aac81cb5777c38dc1dcfc85866bcffb3fde131065e7e34

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    39d96f3010ca60198741d935117ba76c

    SHA1

    45c1c8972c7b3d5d7902e9a0143f794bcc63762f

    SHA256

    706bbf840f5ab1c135845c3670938e329132a9bccec27e965298e417529d2652

    SHA512

    e7e10996d43e125c85582a457fba84e610e5298656525f2f2880b152309611c11f1be414ebb7202f6ada93c5004b888e38df349a63d04794e5f39bdc5399332d

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    e8e9c39d3c25ab5203f203c84743551d

    SHA1

    893e48a620666058a64773bd88b990fa2e0a4380

    SHA256

    382925044dc79abf48a29c25a7f3015090dfc1f0fb4dbe3d8dc1b7a8a3e94100

    SHA512

    05fdcbe52ef1c4f2b2c6a63ef0f766dc2cae81ee1e65deff4d4e0ea5e744a6a6656c281b86a1470aee7c3d10cea03d86e1d86c7c84714c7cb41c13b4e6a70f78

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    42d3591ba91da6ebb922e4b2b2488a1d

    SHA1

    fb38250cef89a5cc222f67cd0c24de22fb5957ae

    SHA256

    31f36ddefa9097f75fb5d86263b65cb38cffa9f9d7c5cafbc64bf8514edaa023

    SHA512

    e6dd52bfdf415060331ee0d804ba2768c9d17a84780ab9ee3d11bf6df9b3056acbb6d86476b6016db51606844d56d92c82e503b684c5b95e0cf561004344f48a

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    6c9a1c44c2a5302bf0ce4cbe8eed2ad4

    SHA1

    8895ff3ed8a1d2ab92bb71b46608c62e3088d0a7

    SHA256

    c194bf62dc7cb7cad79e728580f2c27786f956f0beae45cbf1666c9a38fea870

    SHA512

    a3556ad5a437f6410e8975d2cbcad32a8c2454b9fe737d8986e51ff2d026e28bf2c9f23d579d330cd8be60bd85a4652855324e540b6777954cf430723557e8ae

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    3b83f0fecb48c953d3263d34a4a9c5f0

    SHA1

    3477e46ce8621cf2de76fb93bfe7d1acaf68d481

    SHA256

    bf7eb2c9ac3f95603d7d6a865713b31a335b4c5a5548fa5d036892e6b171e2bd

    SHA512

    9428252558213e551bba2b5258bf468c1b46c8cbe94c406d24f5541ed97a7eff8b41aa251f1d466e9813c6f05e41952060559cff7ccfa718f01b0ff1bf1bc5b6

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    a85b7b7f808c72eb25ab3a236f9eb93d

    SHA1

    4695bcf5cf8687692f307de97befd7619dbb60bf

    SHA256

    c7a62e8631fac35641e0430f40ce982325a30596641a961592bdf277454a26e0

    SHA512

    555f652989fd31fb3340960b8d33a67679e97c6ee051a1271e9df9a26be995f3430b4e1f3b842673cc701ab77cfc4164224dd83f05892bbed358ffeac182342b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    39ba829a6b03dece07898958280f970a

    SHA1

    258e2de803a38de5858b74ec5ff1ba7775ec92d7

    SHA256

    f5680484ca9e82c265ffb667682db254f95e3baa5e1623492389a107a9024624

    SHA512

    67441e257c58638cb6196eba4d48296957ed9d2d401c80cc8aa086196414bb6f04916bd430b35e40bd878c6f39096c076a25c9ccb25dc0a9929eee95e1d79ea7

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    ea6f29ffcf62b47afb9b8236cde8b36f

    SHA1

    5070ea22948e0a12876ee5ffdacaa8c3e8758ecb

    SHA256

    6eed4e420a91e61a3d9e8472656b62a84a0b76c4154b3ba47c25d9baa01085af

    SHA512

    3b9448ba58117b538e55be61042521d6f703d4fcbf3253eb5cc7b0d7bd196acd482402c1a0af07a6b59c6a85d3171130189701991d5f3a32b0ccfc7dd1ed84b9

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    34a27cbb2e7db83f1075c096fd34cb16

    SHA1

    5acb59df44bbdf7ba3f8dd1a8903fba588b9e792

    SHA256

    ada97230b20e1efc13617659afd42984690e61707b10cdd97974c7e429f30d61

    SHA512

    054f8cfb5fa0eeea00b1d006fd062b1701809466c5f2eeb04a4d5512b41c538bcb31b814186fbe265b4c6e1126d5950e8943a6f42c7cb4027ddae768035d7821

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    3daf186df8bcb7f07cf4debf70241e5b

    SHA1

    dd73415e1ddbd83dcfadeff75405eca6183053ff

    SHA256

    fd068adf5e02911a25e28861c551e6bfa15596d33a0f01f88993cc130fa4f511

    SHA512

    74dd4166f35b7491e428a91c89d7143fbb9743488d631953c2cb0c260dbbe63126f178b9c3b49065c420fb2c751bf0f34742f1b61d121ecf73787579925df627

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2220-149-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

    Filesize

    48KB

  • memory/2220-623-0x00007FF8B29A0000-0x00007FF8B3461000-memory.dmp

    Filesize

    10.8MB

  • memory/2220-150-0x00007FF8B29A0000-0x00007FF8B3461000-memory.dmp

    Filesize

    10.8MB

  • memory/2220-148-0x00007FF8B29A3000-0x00007FF8B29A5000-memory.dmp

    Filesize

    8KB

  • memory/2220-622-0x00007FF8B29A3000-0x00007FF8B29A5000-memory.dmp

    Filesize

    8KB

  • memory/4720-46-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-2-0x00000000024E0000-0x0000000002512000-memory.dmp

    Filesize

    200KB

  • memory/4720-135-0x0000000074E60000-0x0000000075610000-memory.dmp

    Filesize

    7.7MB

  • memory/4720-134-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

    Filesize

    4KB

  • memory/4720-9-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-11-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-15-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-18-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-19-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-21-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-23-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-25-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-27-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-29-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-33-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-35-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-49-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-39-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-41-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-43-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-0-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

    Filesize

    4KB

  • memory/4720-47-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-52-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-136-0x00000000054A0000-0x00000000054AE000-memory.dmp

    Filesize

    56KB

  • memory/4720-37-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-132-0x0000000074E60000-0x0000000075610000-memory.dmp

    Filesize

    7.7MB

  • memory/4720-54-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-55-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-57-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-59-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-61-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-131-0x0000000002710000-0x000000000271A000-memory.dmp

    Filesize

    40KB

  • memory/4720-63-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-129-0x0000000004DF0000-0x0000000005394000-memory.dmp

    Filesize

    5.6MB

  • memory/4720-130-0x0000000002650000-0x00000000026E2000-memory.dmp

    Filesize

    584KB

  • memory/4720-66-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-128-0x0000000074E60000-0x0000000075610000-memory.dmp

    Filesize

    7.7MB

  • memory/4720-67-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-4-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-5-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-7-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-14-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-31-0x00000000024E0000-0x000000000250B000-memory.dmp

    Filesize

    172KB

  • memory/4720-3-0x0000000074E60000-0x0000000075610000-memory.dmp

    Filesize

    7.7MB

  • memory/4720-133-0x0000000074E60000-0x0000000075610000-memory.dmp

    Filesize

    7.7MB

  • memory/4720-1-0x00000000024B0000-0x00000000024E2000-memory.dmp

    Filesize

    200KB